Five days before the AI Act deadline: Kimi K3 open, Google must open up Android, and no model meets GDPR requirements

Three developments every Dutch professional using AI in their work should know about this week.

Kimi K3 open weights: the largest open model to date

On 27 July 2026, Moonshot AI published the full open weights of Kimi K3 on Hugging Face, under a Modified MIT licence. With 2.8 trillion parameters and a context window of 1 million tokens, it is the largest open-weight model made publicly available so far.

What makes this relevant for business use in the Netherlands? The hosted API for Kimi K3 processes data on servers in China, with no published standard contractual clauses (SCCs) or adequacy decision, which in principle makes it unsuitable for processing the personal data of EU residents. By hosting the weights yourself on EU infrastructure, you sidestep that transfer problem.

Practical requirements for self-hosting: roughly 1.4 TB of storage and 350–400 GB of GPU memory with MXFP4 quantisation. That is a serious infrastructure investment. For the licence details: check the licence before you plan production use, as earlier Kimi models carried commercial restrictions above a certain scale.

EU forces Google: Claude and ChatGPT as the default assistant on Android

On 16 July 2026, the European Commission issued two binding Digital Markets Act (DMA) decisions regarding Google. The core: by 1 August 2027, Android phones in the EU must also give other AI assistants, such as Claude, ChatGPT or alternatives, the same system access that is currently exclusive to Gemini.

Specifically, this covers wake-word activation at OS level, reading on-screen context and actions within other apps. At the same time, from January 2027 Google must share anonymised search data with competing search engines and AI chatbot providers.

For professionals who genuinely want a free choice in which AI they activate, this is a structural change in the European ecosystem. For more background on which models are available and how they compare, see our model overview.

No major AI model complies with European law

In May 2026, Aithos, an Amsterdam AI research institute, published the results of more than 3,000 tests using their LARA framework (Legal Assessment for Real-world Agents). The conclusion: none of the 12 frontier models tested consistently complies with the GDPR and the AI Act.

The highest-scoring model was Claude Opus 4.7 with 54% compliance, meaning that even the best model broke the law in nearly half of the scenarios tested. Gemini 3.1 Pro scored 10%, DeepSeek-V4-Pro 11%. LARA tested scenarios in which the model could read email, access customer data and communicate with external services, comparable to what agentic AI systems do in practice.

The practical conclusion: the model you deploy is only one part of your GDPR compliance. Your own setup (data processing agreements, instructions, access control) matters at least as much. See our safety overview for the GDPR profiles per model.

Five days to go: AI Act Article 50

From 2 August 2026, in five days' time, the transparency obligations under Article 50 of the AI Act take effect. This has not been postponed. Three obligations apply to every organisation that deploys AI towards end users, regardless of size:

Chatbots and voicebots must identify themselves as AI at the start of every conversation.
AI-generated content (text, images, audio, video) must be marked in a machine-readable way.
Deepfakes and synthetic media on matters of public interest must be clearly labelled.

Fines can reach €15 million or 3% of global annual turnover. Research by Vision Compliance found that 78% of organisations have not yet taken meaningful steps towards complying with Article 50.

Whether you run a customer service bot, send AI summaries or publish generated images, enforcement starts in five days. For a practical starting point, also visit the sector pages to see which obligations apply to your field.

Sources